I just saw a commit for CORS support in OpenAM. I was told by Andy, Product Manager of OpenAM, that CORS will be available in OpenAM 12.
It's a feature required by one of my customers. There are similar requests from ForgeRock's customers as well.
So.. watch out for OpenAM 12!